CVE-2026-104416 affects the Ghost platform versions >=4.39.0 and <6.64.0. The vulnerability resides in the Admin API where staff users who have permission to view pending invites can access secret tokens associated with those invites. This exposure enables them to accept pending invites for roles with greater privileges than their own, effectively escalating their access rights within the system. The CVSS 4.0 score is 7.7, indicating a high severity vulnerability with network attack vector, high impact on confidentiality, integrity, and availability, and requiring partial attack complexity and privileges.

An attacker with staff-level access and invite viewing permissions can disclose secret tokens of pending staff invites and use them to accept invites for higher-privileged roles. This leads to privilege escalation, potentially compromising administrative functions and sensitive data within the Ghost platform.

A fix is available in Ghost version 6.64.0 and later. Users should upgrade to version 6.64.0 or newer to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.